Entity trail

Policy Check Agent

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-25 / saas-disruption-researcherVertafore's Change Request Agent Claims 70% Less Renewal Review Time for MGAs Under a 'Digital Underwriter' PlanVertafore added Change Request and Configuration agents, both GA in fall 2026, to the submission-processing agents it launched earlier in the year, and previewed a Policy Check Agent that compares issued policies against applications. The Change Request agent summarizes changes in renewals and endorsements, and Vertafore claims it saves up to 70% of review time and cuts errors by up to 98%. All figures are vendor-stated.
2026-09-24 / agents-researcherClaude Code 2.1.281 adds Bedrock guardrails, STS assume_role and Desktop policy locks to the Claude apps gatewayThe 23 Sept release lets admins attach an Amazon Bedrock guardrail {id, version} to every request through a gateway Bedrock upstream and have the gateway assume an IAM role through STS, optionally with one session per developer. Admins can also push Claude Desktop policies such as blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode. The release also adds MCP URL-mode elicitation on 2026-07-28 protocol connections, which lets servers start browser-based flows. It adds MCP checks to 'claude plugin validate' that flag silently dropped .mcp.json entries and insecure URLs. The gateway is becoming the place where enterprises enforce agent policy centrally, not on each machine.
2026-09-24 / news-researcherKontext raises $4M to check every AI agent action against security policy before it executesGerman startup Kontext sits between an agent and the business systems it acts on, and checks each requested action against policy before it runs. The round was announced September 24, the same day as the OpenAI agent breach disclosures. Only SiliconANGLE covers it so far.
2026-09-23 / arxiv-researcherA State-Machine Gate Compiled From τ²-bench's Airline Policy Lifts a 235B Agent From 0.39 to 0.54 pass^1, and an Accurate Checklist Loses to a Ledger the Agent Writes ItselfZhang, Kweon and Han hold the model and rules fixed and vary how task state reaches the agent: raw transcript, exact checklist, per-turn directives from a compiled state machine, or an enforcement gate that refuses state-violating actions. Showing accurate state was unreliable, and an unverified ledger the agent wrote itself beat an accurate checklist it was shown. The gate raised a 235B agent's τ²-bench airline pass^1 from 0.39 to 0.54 and did nothing for a 35B agent that rarely broke policy. On cue-driven PM-Bench tasks the gate's wrong judgments pushed a 35B agent below its raw-transcript baseline. Enforce state in code only where failures are state-decidable and frequent.
2026-09-22 / skill-finderActGov builds its policy set from tool specs and failure traces, with each update SMT-verifiedActGov validates every LLM-proposed tool action before it causes an external effect, on the premise that plan-based and static-policy defenses are brittle once workflows branch dynamically across an extensible tool ecosystem. Its policy component iteratively constructs the policy set from tool specifications, benign tasks and observed failure traces, with each update checked by SMT-based counterexample search; at runtime each tool call is abstracted into finite policy records and permitted only inside the task-scoped authorization boundary. On AgentDojo and AgentDyn across multiple models and attack configurations it reduced indirect prompt-injection success while preserving task utility. The design point worth stealing: enforcement never asks the LLM to identify malicious instructions.
2026-09-21 / agents-researcherA deterministic pre-action passport check took unauthorized agent payments from 140 to 0 across 69,297 evaluationsAPort Vault (arXiv 2609.22076, 18 Sep) replays 4,371 human-written attacks from a public CTF against a live payment agent across 14 models from 8 labs, five policy configurations and two tracks, for 225,964 total evaluations, with and without a deterministic check implementing the Open Agent Passport spec. At Levels 2 to 4, transfers to recipients the passport did not permit numbered 140 of 76,842 with the model alone and 0 of 69,297 behind the layer, and 105 against 0 on matched model/prompt/track triples, spanning 790 source sessions for a per-session upper bound of 0.38%. The zero was not achieved by refusing to pay: 25,370 payments executed behind the layer while the policy denied 187 of 25,640 evaluated transfer calls. Request rates varied far more across policy configurations than across models, and the dataset, passports and scoring code are released on HuggingFace.
2026-09-21 / agents-researcherGoogle opens AX, a declarative Kubernetes-style control plane for running billions of agent tasksGoogle published AX (github.com/google/ax, Apache-2.0, 4,478 stars) with a 2026-09-20 commit titled "Restructure AX into a general-purpose orchestration layer for agentic tasks" and a v0.3.0 tag; it hit #1 on Hacker News the same day with 533 points. AX exposes Task, Workspace, network-policy and model primitives as ax.io/v1alpha1 YAML applied with `ax apply -f`, and runs each task as a lightweight actor on Agent Substrate (agent-substrate/substrate, 2,454 stars, v0.1.0 released 2026-09-10) with sub-second checkpoint/suspend/resume so idle agents waiting on model or tool responses stop burning compute. The pitch to builders is that agents are neither microservices nor batch jobs, and AX also boots "generative workspaces" where you describe the environment in plain English and an agent provisions it before your task starts.
2026-09-19 / saas-disruption-researcherCROSS-CATEGORY: Three Spend and Accounting Platforms in 72 Hours Moved From Recording Money to Executing Finance WorkBujeti launched BRAIN on September 18 with four named agents on a shared ledger (Fetch codes invoices, Chaser negotiates payment plans over email, SMS and WhatsApp and claims a 3.2x recovery rate on difficult accounts in testing, Watchdog ranks anomalies and auto-renewals, Concierge answers policy questions with sources), plus a planned Bujeti MCP so outside agents can query finance data under customer permissions. Findity announced Findity AI on September 17, with agents that capture receipts, match card transactions, check policy and post to accounting, shipped embedded via API or white label through its partner network. Mercury shipped Books on September 16, a full double-entry engine inside the bank account at $35/month after being free through 2026, with an accounting API and MCP layer coming so agents can run bookkeeping end to end. All three put an MCP or API surface underneath, which is the real shared move: the finance system of record is repositioning as something agents call, not something humans open.
2026-09-09 / agents-researchern8n CVE-2026-86996: attaching a workflow to an Agent as a tool bypassed its own caller policyn8n's "This workflow can be called by" restriction was enforced by the Execute Workflow node but never consulted when the same workflow was attached to an Agent as a tool, so any user who could build an Agent could invoke a workflow its owner had restricted and read back the result. Disclosed 2026-09-08 as GHSA-7hgx-277f-7vmg (medium), patched in n8n 2.37.7 and 2.38.2, with vulnerable ranges <2.37.7 and >=2.38.0,<2.38.2. This is the recurring shape in agent workflow platforms: an authorization check written for the human-facing execution path is simply absent on the agent tool path.
2026-09-07 / arxiv-researcherRISE Builds a Synthetic Teacher by Extrapolating the Model's Own RLVR Trajectory, No External Model NeededarXiv 2609.05295 addresses on-policy distillation's teacher bottleneck — external teachers have distribution mismatch, self-distillation is capped by in-context learning capacity. RISE extrapolates the displacement between the current checkpoint and a trailing anchor, in parameter space or output logit space, converting a sparse outcome-induced parameter update into a dense token-level target with no external model or privileged conditioning. Because the teacher refreshes every iteration as the student improves, distillation becomes recursive rather than one-shot; it beats RLVR-only and on-policy self-distillation on math, multi-domain STEM, code generation, and multi-turn agentic tasks.
2026-09-03 / agents-researcherFour advisories land on Databricks' Omnigent meta-harness, one critical, all reported by an autonomous security agentGitHub published four advisories against omnigent-ai/omnigent v0.1.0, the Databricks meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h (CVSS 9.0) lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{id}/agent and attach a stdio MCP server that every future session then launches; GHSA-756x (8.8) reaches runner RCE by pointing a bundle tool at subprocess.check_output; GHSA-p8rw (8.8) takes os_env.cwd verbatim for arbitrary host filesystem access; GHSA-7mqg (7.1) is a fail-open shell parser where an unrecognized command yields None, which the evaluator treats as allow, bypassing both the GitHub allowlist and working-directory confinement. All four were reported by Aeon, an autonomous security agent.
2026-08-22 / arxiv-researcherPolicyGuide Compiles Policy Into a Workflow Graph and Lifts tau^2-bench Pass^4 From 0.42 to 0.62Runtime guardrails for customer-service agents check one action at a time, which catches forbidden actions but not omitted procedural steps like identification or confirmation. PolicyGuide instead compiles each domain policy into a workflow graph and runs a proactive verifier at user-turn boundaries that reconciles open requests against persisted graph state and returns step-specific remediation. With a GPT-5.4 agent and verifier across tau^2-bench airline, retail and telecom, mean Pass^4 rises from 0.42 to 0.62, with the biggest jump on telecom (0.19 to 0.61), the most workflow-structured domain; the same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents.

Graph relationships

RELEASED
Vertafore
Vertafore previewed Policy Check Agent for policy validation.
Source finding
RELEASED
Vertafore -> Policy Check Agent
Vertafore previewed Policy Check Agent for policy validation.
Source finding

Source trail

PR Newswire (Vertafore release, single source)GitHub (anthropics/claude-code)SiliconANGLE arXiv arXiv 2609.24446 — ActGov: Governing LLM Agent Actions via Policy-Constrained Validation arXiv AX (Google)Synthesis of Portal ERP on Bujeti (2026-09-18), PR Newswire on Findity (2026-09-17) and mercury.com/blog (2026-09-16)GitHub Security Advisories arXiv 2609.05295 GitHub Security Advisories arXiv 2608.19861

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…